Get XQL Query Quota

post /public_api/v1/xql/get_quota

Retrieve the amount of query quota available and used for this tenant, including the number of daily running queries, the number of active queries, and the number of queries run concurrently today on this tenant.

Note: This endpoint only works on XQL queries initiated by /public_api/v1/xql/start_xql_query/.

For more information on how to run XQL queries, see Running XQL Query APIs.

Required license: Cortex XDR Pro per Endpoint or Cortex XDR Pro per GB

Body parameters

Object

REQUEST BODY


    Object

CURL

  curl -X 'POST'

        -H
        'Accept: application/json'
      
        -H
        'Content-Type: application/json'
      
      'https://api-yourfqdn/public_api/v1/xql/get_quota'
    
      -d
      ''

Responses

Successful response

Body

replyObject

license_quotaInteger

additional_purchased_quotaInteger

used_quotaNumber

eval_quotaInteger

total_daily_running_queriesInteger

The number of daily active queries. This value is reset nightly.

total_daily_concurrent_rejected_queriesInteger

The number of daily queries rejected due to too many concurrent XQL queries being run through the API. This value is reset nightly.

current_concurrent_active_queriesObject

Currently running XQL queries with their current duration.

current_concurrent_active_queries_countInteger

The number of active queries currently running.

max_daily_concurrent_active_query_countInteger

The maximum number of queries that ran concurrently today on this tenant. This value is reset nightly.

RESPONSE

{
    "reply": {
        "license_quota": 5,
        "additional_purchased_quota": 0,
        "used_quota": 0,
        "eval_quota": 0,
        "total_daily_running_queries": 4,
        "total_daily_concurrent_rejected_queries": 8,
        "current_concurrent_active_queries": {
            "debee6b0c41f47_911_inv": {
                "xql": "config timeframe = 1mo | dataset=xdr_data | limit 1000000",
                "duration": 61
            }
        },
        "current_concurrent_active_queries_count": 1,
        "max_daily_concurrent_active_query_count": 4
    }
}

Bad Request. Got an invalid JSON.

Body

replyObject

err_codeInteger

err_msgString

err_extraObject

err_msgString

query_costInteger

remaining_quotaInteger

total_daily_running_queriesInteger

total_daily_concurrent_rejected_queriesInteger

RESPONSE

{
    "reply": {
        "err_code": 500,
        "err_msg": "An error occurred while processing XDR - XQL query",
        "err_extra": {
            "err_msg": "reached max allowed amount of parallel running queries. please wait for some queries to finish and submit your query again",
            "query_cost": 0,
            "remaining_quota": 5,
            "total_daily_running_queries": 4,
            "total_daily_concurrent_rejected_queries": 1
        }
    }
}

Unauthorized access. An issue occurred during authentication. This can indicate an incorrect key, id, or other invalid authentication parameters.

Body

err_codeString

HTTP response code.

err_msgString

Error message.

Example:{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extraString

Additional information describing the error.

RESPONSE

{
    "err_code": "err_code_example",
    "err_msg": "{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}",
    "err_extra": "err_extra_example"
}

Unauthorized access. User does not have the required license type to run this API.

Body

err_codeString

HTTP response code.

err_msgString

Error message.

Example:{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extraString

Additional information describing the error.

RESPONSE

{
    "err_code": "err_code_example",
    "err_msg": "{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}",
    "err_extra": "err_extra_example"
}

Forbidden access. The provided API Key does not have the required RBAC permissions to run this API.

Body

err_codeString

HTTP response code.

err_msgString

Error message.

Example:{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extraString

Additional information describing the error.

RESPONSE

{
    "err_code": "err_code_example",
    "err_msg": "{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}",
    "err_extra": "err_extra_example"
}

Internal server error. A unified status for API communication type errors.

Body

err_codeString

HTTP response code.

err_msgString

Error message.

Example:{"line": 1, "column": 19, "message": "no viable alternative at input '|alter2'"}

err_extraString

Additional information describing the error.

RESPONSE

{
    "err_code": "err_code_example",
    "err_msg": "{\"line\": 1, \"column\": 19, \"message\": \"no viable alternative at input '|alter2'\"}",
    "err_extra": "err_extra_example"
}